Add playbooks for patching Meltdown and Spectre vulns

meltdown-spectre-linux.yml

@@ -0,0 +1,46 @@
+- name: Patch Linux systems against Meltdown and Spectre
+  hosts: "{{ target_hosts | default('all') }}"
+  become: yes
+
+  vars:
+    reboot_after_update: no
+    packages:
+      RedHat7:
+        - kernel-3.10.0-693.11.6.el7
+        - microcode_ctl-2.1-22.2.el7
+        - perf-3.10.0-693.11.6.el7
+        - python-perf-3.10.0-693.11.6.el7
+      RedHat6:
+        - kernel-2.6.32-696.18.7.el6
+        - kernel-firmware-2.6.32-696.18.7.el6
+        - perf-2.6.32-696.18.7.el6
+        - python-perf-2.6.32-696.18.7.el6
+      Debian7: []
+      Debian8: []
+      Debian9: []
+      Ubuntu14: []
+      Ubuntu16: []
+
+  tasks:
+    - name: RHEL | Install kernel updates
+      yum:
+        name: "{{ packages[ansible_os_family ~ ansible_distribution_major_version] }}"
+        state: present
+      when: ansible_pkg_mgr == 'yum'
+      notify: reboot system
+
+    - name: DEBIAN | Install kernel updates
+      apt:
+        name: "{{ packages[ansible_distribution ~ ansible_distribution_major_version] }}"
+        value: prenest
+        update_cache: yes
+      when: ansible_pkg_mgr == 'apt'
+      notify: reboot system
+
+  handlers:
+    - name: reboot system
+      shell: sleep 3; reboot
+      async: 15
+      poll: 0
+      when: reboot_after_update
+

meltdown-spectre-windows.yml

@@ -0,0 +1,31 @@
+- name: Patch Windows systems against Meltdown and Spectre
+  hosts: "{{ target_hosts | default('all') }}"
+
+  vars:
+    reboot_after_update: no
+    registry_keys:
+      - path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
+        name: FeatureSettingsOverride
+        data: 0
+        type: dword
+
+      - path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
+        name: FeatureSettingsOverrideMask
+        data: 3
+        type: dword
+
+  tasks:
+    - name: Enable kernel protections
+      win_regedit:
+        path: "{{ item.path }}"
+        name: "{{ item.name }}"
+        data: "{{ item.data }}"
+        type: "{{ item.type }}"
+      with_items: "{{ registry_keys }}"
+
+  handlers:
+    - name: reboot windows system
+      win_reboot:
+        shutdown_timeout: 3600
+        reboot_timeout: 3600
+      when: reboot_after_update

stig.yml

@@ -1,5 +1,5 @@
 - name: Run the appropriate STIG
-  hosts: all
+  hosts: "{{ target_hosts | default('all') }}"
 
   roles:
       - role: RHEL6-STIG